Steven Danna stevendanna

Understand the Permissions Requested by an oc_chef_wm Module

Chef Server API requests are eventually routed to a module in the oc_chef_wm application. These modules implement the 'chef_wm' behavior. A behavior defines a set of callback functions that are used to process each request.

For authorization, the relevant callback function is auth_info/2. auth_info/2 takes 2 arguments: The Request (which holds all the information about the HTTP request, such as method, path, etc) and the

Supposed Cause

Chef Server 12.0.8+ contains a new version of our underlying postgresql client library and a new version of the sqerl library which provideds an abstraction over that. These updates included the following change:

https://github.com/chef/sqerl/commit/11d08f363fa61958f5e46d2560447931f88ae3ee

which results in the following query being sent before each query that we send to sqerl:

set statement_timeout=5000

	#!/usr/bin/env ruby
	#
	# sigign: exec a command with signals ignored
	#
	# Usage: sigign SIGNAL[,SIGNAL..] COMMAND
	#
	# sigign sets the disposition of the specified signals to SIG_IGN
	# before exec'ing the specified command.

	ignored_signals = ARGV.shift.split(",")

	save-last-command() {
	last_command=$(fc -nl 0)
	command_name="$1"
	read -r -d '' new_fun <<EOF
	${command_name}() {
	$last_command
	}
	EOF
	eval "$new_fun"
	}

	#!/bin/bash
	#
	# Warn about possible cloud access keys before committing
	#
	exec </dev/tty
	unset possible_keys
	possible_keys=$(git diff --cached \| egrep '^[+\-].*(AKIA\|AWS_ACCESS\|AWS_SECRET\|OS_PASSWORD\|OS_USERNAME)')
	if [[ -n "$possible_keys" ]];then
	echo -e "WARNING: Diff contains possible access keys:\n"
	echo "${possible_keys}"

	#!/opt/opscode/embedded/bin/ruby

	require 'sequel'
	require 'json'
	require 'uri'
	require 'net/http'

	orgname = ARGV[0]
	if orgname.nil?
	STDERR.puts "usage: danger_add_users_to_global_admins_group ORGNAME"

	* Benchmark Code

	#+NAME: jsonbench
	#+BEGIN_SRC erlang
	#!/usr/bin/env escript
	%% -- erlang --
	%%! -smp enable -sname jsonbench -pa deps/jiffy/ebin
	-mode(compile).

	main([Iter]) ->

	def resource_exists?(resource_spec)
	resources(resource_spec)
	true
	rescue Chef::Exceptions::ResourceNotFound
	false
	end

	In terminal 1

	> mkfifo test.fifo
	> gcc test.c
	> ./a.out

	In terminal 2

	> cat >test.fifo
	(Interrupt with ctl+C)

	my_test "foo" do
	action :create
	end